Documentation

Install

EyeKeen runs on macOS 12 or later, on Apple silicon and Intel Macs. After you subscribe, download it from your account at account.eyekeen.dev; your licence key is there and in your welcome email.

1. Open the downloaded .dmg and drag EyeKeen into Applications. If you open it straight from the installer window instead, EyeKeen offers to move itself.
2. Open EyeKeen from Applications. The first time, read and accept the licence agreement.
3. Paste your licence key. It starts with EYEKEEN1. and is tied to your email address. You only do this once; while you subscribe, the app renews it by itself.
4. Create a local account: an email and a password for this Mac only. Nothing is registered anywhere. If you forget the password, Forgot password? resets it after Touch ID or your Mac password.

Tick Remember this Mac when you sign in if you don't want to type the password every time. The session is kept in your Keychain, and Sign out in the account menu removes it.

Connect AWS

EyeKeen uses the profiles that are already in your AWS CLI configuration (~/.aws/config and ~/.aws/credentials). It never asks for an access key and never copies one.

After you create your account, the setup assistant walks you through five steps:

1. Project. Give it a name, for example the product or team it covers.
2. Account. Pick a profile. For an SSO profile with an expired session, press Sign in with SSO; your browser opens the usual AWS approval page.
3. Region. EyeKeen suggests the regions where it finds resources.
4. Access. EyeKeen checks which read permissions the profile has and tells you what will be missing.
5. Resources. It finds your ECS clusters and services, load balancers and log groups, and preselects the likely ones. Change anything that is wrong, then save.

No profile yet? For SSO, run aws configure sso in Terminal. For an access key, run aws configure --profile name. Then choose Check again in the assistant.

Other AWS accounts

To watch an account you don't have a profile for, add an environment with Role as the sign-in method. EyeKeen generates a CloudFormation template for a read-only role that trusts only your own account and a fixed external ID. Create the stack in the other account, paste the role ARN back into EyeKeen and press Verify role. Every session EyeKeen opens with that role also carries a policy that denies writes, so the role can't be used to change anything through EyeKeen even if someone later widens it.

Permissions

EyeKeen only calls describe, get and list operations, from a fixed list built into the app. Anything else is refused before a request is made. You can give it less than everything; the screens that need a missing permission say so.

The AWS managed policy ReadOnlyAccess covers everything except AI, which also needs bedrock:InvokeModel. The role template mentioned above lists the exact actions instead, so you can see every one.

Projects and environments

A project is a group of environments that belong together, with its own history, runbooks and settings. An environment is one AWS account and region, optionally narrowed to an ECS cluster and service. Most teams start with one project and two environments, production and staging.

Switch between them from the menu at the top left. Adding, renaming and deleting projects is in the same menu; deleting asks first, and removes that project's map, history and settings from this Mac. Environments are edited under Settings → Environments, where changes take effect when you press Save.

The screens

Overview

Is everything up? Running tasks, the last deployment, alarms, queue depth and the last three hours of load.

Timeline

Metrics, deploys, alarms, configuration changes and errors on one time axis. Click a point to see the account as it was at that moment, or drag across a range to analyse it.

Architecture

A map of what is running, built from your AWS inventory. Click any node for its metrics and recent changes. Remap rebuilds it with AI after big changes.

Lambdas and Live logs

Function errors and durations, and a live tail of CloudWatch log groups with search.

Now

What needs attention right now, with suggested actions and the alert history.

Foresight and Capacity

Trends that are heading for a limit, and what happens to each tier if traffic grows.

Savings

Resources that cost money and do nothing, with the monthly cost and the evidence. EyeKeen never deletes anything; you do that in your own console.

Security

Two parts. AWS account gathers GuardDuty, Security Hub, CloudTrail and IAM findings into one list with a score. Dependencies checks the packages in your GitHub repository (see below). A finding only counts as fixed when AWS or the next scan stops reporting it.

Runbook and Deploys

Your own notes for common fixes, and GitHub workflow runs, pull requests and which commit each environment is running.

Dependencies

EyeKeen reads your repository's lockfiles through your own GitHub CLI login and checks the exact version of every package against the GitHub Advisory Database. Nothing in the repository changes unless you allow it.

Set up

1. Install the GitHub CLI and sign in once by running gh auth login --hostname github.com --web in Terminal.
2. In EyeKeen, go to Settings → GitHub, choose Find my repositories and pick the one for this project.
3. Open Security → Dependencies. The first scan of a large repository can take up to a minute; a progress bar shows what it is doing.

EyeKeen reads package-lock.json, yarn.lock, pnpm-lock.yaml, pinned requirements*.txt, Pipfile.lock, poetry.lock, composer.lock, Cargo.lock and Gemfile.lock, anywhere in the repository. If Dependabot alerts are on, they fill in other ecosystems such as Maven and Go.

How findings are ranked

The same vulnerability found in several lockfiles is shown once, with every place it appears. Each finding gets a priority and the reasons for it:

A package that is running in one of your AWS environments right now moves up one level. A package your code never imports moves down one, but an exploited vulnerability never goes below P1.

Fixing

The Fix list turns findings into upgrades, because one upgrade often fixes several of them. Each row says whether only the lockfile changes, whether it is a normal upgrade, or whether it is a breaking (major) one, and gives the command to run. If Dependabot already has a pull request open for it, the row links to it.

Use the Scan menu to check another branch, or exactly what one of your AWS environments is running. Download JSON saves the full report; Download patch saves the package.json and requirements edits as a file you can apply with git apply.

Options

• Check which packages the code imports (on by default). Reads the repository archive into memory to rank unused packages lower. Nothing is written to disk.
• Ask the npm registry which parent version fixes a transitive package (off). Sends the affected package names to registry.npmjs.org.
• Allow EyeKeen to change this repository (off). Enables two buttons: turning on Dependabot security updates, and opening a pull request for pinned Python packages. Each still asks before it does anything.

AI analysis and cost

Questions, incident write-ups, post-mortems and briefings run on Amazon Bedrock, in your AWS account, with your credentials. Choose the model and region under Settings → AI, and press Test to check that the model is enabled in that region. If it isn't, enable it in the Bedrock console under Model access.

Bedrock bills you directly; Addrivo never sees these requests and doesn't charge for them. As a rough guide, one request costs a few cents on Claude Sonnet and about a third of that on Claude Haiku. Most people spend between $5 and $20 a month. Settings → AI shows what you have actually used, by day, feature and model, estimated from the token counts Bedrock reports. Your AWS bill is the exact figure.

Nothing is sent to Bedrock unless you ask for it, with one exception: opening the Now screen builds a list of suggested actions, which is reused for ten minutes.

What leaves your Mac

EyeKeen has no server that sees your AWS or GitHub data. The app talks to these services, and only these:

• AWS, with your profiles, for the read operations described above, and Bedrock when you use AI.
• GitHub, with your GitHub CLI login, if you connect a repository.
• CISA: a download of the public list of exploited vulnerabilities. Nothing about you is sent.
• account.eyekeen.dev: your licence key, near its expiry, to receive a renewed one.
• registry.npmjs.org, only if you turn on registry lookups.

Your settings, history and local account are stored in ~/Library/Application Support/EyeKeen. The configuration file is readable only by you. To remove everything, quit EyeKeen and delete that folder.

Keyboard shortcuts

Troubleshooting

"The AWS session for this environment has expired"

Your SSO session ran out. EyeKeen starts the sign-in for you; approve it in the browser. If that doesn't work, run aws sso login --profile name in Terminal.

"Your Mac's disk is full"

EyeKeen needs a little free space for its database and the AWS CLI for its sign-in cache. Free some space in System Settings → General → Storage, then reopen EyeKeen.

"EyeKeen's local server is not responding"

The part of EyeKeen that talks to AWS stopped. It restarts by itself; if the message stays, quit and reopen the app. The log is at ~/Library/Application Support/EyeKeen/desktop-server.log.

"Sign in to GitHub CLI"

Run gh auth login --hostname github.com --web in Terminal, then press Try again.

"No package versions to check"

The repository has no lockfile EyeKeen can read and Dependabot alerts are off. Commit a lockfile, or turn on Dependabot alerts in the repository's settings on GitHub.

AI answers fail with an access error

The model isn't enabled in that region, or the profile lacks bedrock:InvokeModel. Enable the model in the Bedrock console, or choose another region in Settings → AI.

Plans, keys and billing

Sign in to account.eyekeen.dev with your email address; we send you a link, there is no password. Your account page has your licence key, the download, and, under Billing and invoices, your invoices, payment details and cancelling.

Keys renew themselves

A key is valid until the end of the period you paid for, plus seven days. In the last ten days, EyeKeen sends the key to account.eyekeen.dev and receives a fresh one while your subscription is paid. The key is the only thing the app sends to Addrivo. If renewal can't happen (the subscription ended, or the Mac was offline for weeks), the licence screen says so; renew in your account, then choose Check my subscription.

Business seats

The person who buys a Business plan manages its seats. On the account page, enter a colleague's email under Give a seat; they get their own key by email and can sign in with that address. To move a seat, remove it and give it to someone else; the old key stops renewing. Change the number of seats on the same page; Stripe charges or credits the difference on the next invoice.

Cancelling

Cancel under Billing and invoices. Nothing more is charged, and EyeKeen works until the end of the period you paid for. The full terms are in the licence agreement.